Skip to main content

Table 1 A summary of the variables applied in the SNAD framework.

From: Specializing network analysis to detect anomalous insider actions

Variable Description
S = {s1, s2, . . . , s m } The set of subjects in the CIS.
U = {u1, u2, . . . , u n } The set of users in the CIS.
u j s i An access of user u j to subject s i .
U s i The set of users that access subject s i .
N e t s i A complete graph of U s i .
SU A binary matrix of subjects and users, the size of which is m × n. If u i accesses s j , SU(j, i) = 1, else SU(j, i) = 0.
U i A column vector of access history of u i on all subjects. U i = SU[:, i].
SU_IDF A matrix with the same size as SU. Each cell value of SU_IDF corresponds to its inverse document frequency (IDF) transformation.
B = [1, 1, . . . , 1] A vector of 1's of length m.
IDF_U i A column vector of access history of u i on all subjects. IDF_U i = SU_IDF[:, i].
PC' A matrix created from SU or SU_IDF, the size of which is l × n, where l is the number of selected principal components.
λ k The kth eigenvalue
λ total The sum of the l eigenvalues.
λPC' A matrix created from PC', where λPC'[k, :] = (λ k /λ total ) × PC'[k, :].
C i A column vector of u i on the selected l principal components. C i = λPC'[:, i].